Questions tagged [password-cracking]

for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.

Filter by
Sorted by
Tagged with
1
vote
2answers
601 views

How to crack a password given its hash and its possibilities

I am trying to crack a number of passwords that have been hashed using SHA-256. I have the hashes available and I also have the possibilities in which the password can be. Some of these possibilities ...
1
vote
2answers
527 views

Why providing many protected zip files will increase the chance of retrieving the password

In fcrackzip man they say : the more files you provide, the better. I want to know why. What's the method it uses to retrieve the password?
3
votes
2answers
900 views

Cracking a MD5 hash from numerical input

I am trying to crack one of multiple MD5 hashes that have been created from numerical input. I have a sample of 1000 MD5 hashes that are generated from numerical input. I know that the input is ...
1
vote
2answers
303 views

How bad is using date to generate a “random” password?

I came across a post about generating random passwords. Apparently the preferred way is date | md5sum I am aware that using the date for this is bad, but how bad is it? How does it fare when ...
2
votes
1answer
559 views

What does ssh-keygen's -a option really mean?

I discovered the newer OpenSSH format for storing SSH private keys (ssh-keygen -o) uses bcrypt to generate the symmetric key to encrypt the private key. I understand that the -a option is used to ...
0
votes
1answer
187 views

Choose a sentence, a number, and the name as password [duplicate]

I would like to have your point of view about something I found on internet. The goal here is to help people to use stronger passwords, it's not perfect, but I believe that asking people to use ...
1
vote
1answer
422 views

Cracking Salted Peoplesoft Hashes

So I felt the saga of my last post was getting too long (linked here: Unknown round length makes hash uncrackable?) so I would create a new one addressing the current problem as it stands. My new ...
1
vote
1answer
671 views

Define Patterns in Crunch

I am trying to achieve a very specific pattern with crunch. The Wireless Router I use has a very specific Pattern used for the default Password generated by my Provider. I want to create a wordlist or ...
3
votes
2answers
243 views

How to choose between password derivation or encryption?

Suppose you use a password manager having all possible features of modern password managers: encryption with a key derived from your master password, auto-filling, cloud or local storage, browser ...
3
votes
2answers
173 views

Is using a phrase from a book as a password such a bad idea

I've been told/seen online that choosing a sentence or a phrase from a book and using it as a password is a bad idea. How is this true? Unless the potential attacker knew which book you used I don't ...
24
votes
8answers
7k views

Is there a way to make a WEP-secured AP uncrackable?

For some days, I was feeling that my Internet bill was booming. Then, I recently found out that a boy near my house was accessing my router to use the Internet. Then, I read some articles how to crack ...
1
vote
1answer
314 views

Can a password cracker reverse engineer my generation method?

Lets say I generated a password with really awful entropy seed (5 bits~), but then used another selection process (with a low entropy seed as well) to select at random a method to generate a password (...
2
votes
1answer
9k views

Hardware compatibility with Hashcat in Windows 10 (64-bit)

This question is not a security question but about a security tool. Why am I unable to leverage my decent hardware (I think) with hashcat? This is what I see when I run hashcat in Win 10 (64-bit). ...
1
vote
2answers
3k views

Incremental charset with no duplicate adjacent letter [closed]

I'm using John the Ripper and the following charset in the creation of a word list: [Incremental:Upper8] File = $JOHN/upper.chr MinLen = 8 MaxLen = 8 CharCount = 36 The command: john –stdout –...
0
votes
3answers
138 views

Would it be more secure to enforce “at least one upper case” or to enforce “at least one letter (any case)”

I am devising a set of password requirements. I am requiring users to use the following: Minimum 8 characters Minimum 1 number Minimum 1 special character Minimum 1 letter (any case) I would like ...
1
vote
0answers
45 views

Increase password iterations?

Is it possible to strengthen the macOS login password by increasing the number of sha-512 iterations?
2
votes
1answer
313 views

How do Field Programmable Gate Arrays (FPGAs) compare to Graphics Processing Units (GPUs); for cracking hashes?

As a general rule, GPUs are more effective than CPUs when it comes to performing acutely repetitive tasks, like iterating over lists and generating permutations of a set (i.e. exhausting dictionaries &...
1
vote
0answers
133 views

How to create a keygen [closed]

I have a list with approx 500 serial numbers (each one with 10 digits) and all the 500 passcodes generated for those serials (also with 10 digits, but alphanumeric). Is possible to discover the ...
2
votes
1answer
766 views

Hashcat: How to discard words of length less than N after rules have been applied?

Hashcat: How to discard words of length less than N after rules have been applied? I know of the rules <N and >N that discards the word if its length is less than and greater than N, ...
1
vote
1answer
86 views

Do hacks of mainstream web applications tend to happen more from random attackers brute forcing or from targeted heuristic attacks?

I'm writing up advice for selecting a master password for a password manager, and I'm wondering if there is available data about the likelihood of different attacks that result in a cracked password. ...
3
votes
1answer
12k views

Decrypting SAM hive after Windows 10 anniversary update?

After a lot of frustration I've finally cracked my local Windows 10 password using mimikatz to extract the proper NTLM hash. In particular, samdump2 decrypted the SAM hive into a list of users with "...
5
votes
1answer
6k views

Chinese or “pinyin” wordlists for dictionary attacks

Background: I am currently trying to crack a salted md5 hash which I have recovered from an embedded device running busybox and manufactured in china. I have tried john the ripper using all of the ...
-2
votes
2answers
382 views

What are most dangerous vulnerabilities of users of password management? [closed]

Are there any examples where something goes wrong. For example, say people misused password managers and got hacked or take some loss? If so how? Basically, I sort of know the typical vulnerabilities ...
1
vote
1answer
175 views

If someone has a hashed password, how long till they decrypt it?

Earlier my friend suggested that we have a race to see who could decrypt a hashed password first. I want to do it but I don't want it to be an all month thing. I know when passwords are hashed they ...
1
vote
0answers
76 views

How to brute force ARJ passwords? [closed]

I came across some password protected ARJ files. Can anyone name a password cracker for those archives? Ideally running on linux or OSX.
1
vote
1answer
784 views

Are partial passwords a security improvement over full passwords?

With full password authentication, you need to enter the full password every time. With partial password authentication, you're asked for some subset of the password each time, and which characters ...
7
votes
3answers
3k views

Encrypted password inside compressed archive

File compression utilities like Winrar or ZIP or 7zip encrypt the password and store it inside the archive. How safe is that? I mean you are giving away the archive with the password inside,it's not ...
27
votes
4answers
11k views

Cracking double encrypted router password?

I noticed in the html of my router this parameter: form.addParameter('Password', base64encode(SHA256(Password.value))); So when I type in the password passw I get this via sslstrip: 2018-09-25 21:...
39
votes
3answers
62k views

How secure is 7z encryption?

I have a text file in which I store all my bank details. I compress and encrypt it with 7-Zip using the following parameters: Compression parameters: Archive format: 7z Compression level: Ultra ...
2
votes
1answer
94 views

Is there any defense against this kind of attacks? (key comparison attack, or something)

is there any defense against this kind of attack? https://youtu.be/7U-RbOKanYs?t=974 I know someone who uses a password encryption hashing that generates the same length of keys as in this video and ...
3
votes
2answers
706 views

John the Riper couldn't crack all the passwoords

I have a password file with 7 passwords, but JTR only could crack 4 and 3 that couldn't. What it's the reason? C:\tmp\john179j5\run>john --show shadow.txt root:password:12923:0:99999:7::: student1:...
1
vote
1answer
805 views

John the Ripper and incremental mode

I have a question about John the Ripper and it's incremental mode. As far as I know, the incremental mode is a brute-force mode, and it tries to get the password by systematic combining all ...
4
votes
1answer
7k views

Hash list for practicing password cracking

I am looking for resources like a hash cracking competition, but offline. More like a practice list of specifically crafted "passwords" hashed for the purpose of testing various cracking techniques. ...
1
vote
3answers
8k views

Hashcat doesn’t write to output file [closed]

I am using hashcat to crack a list of md5 hashes and have used the following command hashcat -m 0 -a 0 -o out.txt --force hashdump.txt ../rockyou.txt which gives the output Session..........: ...
0
votes
3answers
140 views

Assuming my password is strong enough, how else can I protect my account? [closed]

I'm a very insecure person, so I made my gmail account's password so long, that I started to question whether or not it's possible for someone to hack it with any given method (It's a passphrase with ...
1
vote
1answer
335 views

Best practices to protect public/private SSH key pair in web interface?

I've got a dilemma here: I'm working on a system that will connect to remote linux servers for monitoring and automating some processes. Since user+pass is insecure for obvious reasons and public/...
1
vote
0answers
547 views

crunch password generation with multiple character sets

I'm trying to use crunch to generate a password list. However, if I add all necessary characters into one character set, as in: file: charset_huge.lst complex = [...
1
vote
1answer
174 views

How to increase the time for an offline password attack

I am trying to answer a CASP exam practice question. Could someone comment on the options below regarding the logic behind each item? Where is the logical error behind each statement? A Storage-...
1
vote
1answer
4k views

Best tool to BruteForcing RDP

I have tried many tools and to do not seem to be successful with locking out an account I am testing on my network with an RDP domain. I used crowbar, ncrack and THC hydra but they don't seem to be ...
39
votes
14answers
14k views

How can I make a strong password that's easy to remember? Is the 4 Word method safe? [duplicate]

I have heard of the method of using 4 random dictionary words, it gives you lots of characters and is easy to remember. But that seems to be open to dictionary attacks, especially if the attacker has ...
1
vote
1answer
820 views

hashcat specific brute force

Is this scenario possible: I know the first three letters of the password (exact), i know the password is between 10-14 characters, i know the rest of the characters are "b,t,p,1,3,6,7" which can be ...
-1
votes
1answer
215 views

Where can i find a pre-computed 8 caracter uppercase password file/dictionary

To create an all permutations dictionary of an 8 character uppercase only password, I get I can use crunch to make this wordlist and file would roughly be 1.8 - 2Tb in size. Is there anywhere I can ...
3
votes
1answer
2k views

Crack Putty Private Key (PPK)

I found a private key which seems to be in the putty private key format. The key has the following header: ---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ---- Subject: <sensitive> Comment: <...
9
votes
1answer
1k views

Mitigating the new attack on WPA2 involving PMKID

A new attack was discovered which allows cracking a WPA2 passphrase without needing to capture the 4-way handshake. While this doesn't weaken the password itself, it does mean that an attacker can ...
2
votes
1answer
984 views

JtR with Excel 2013

I need to recover a PW for an Excel 2013 workbook. I am using Kali. When I try to run the workbook or any individual tab through Office2John, I get "Invalid OLE file". So I renamed to .zip, extracted ...
1
vote
2answers
729 views

Finding and attacking an IMAP Server

For a security challenge I am supposed to dictionary attack an IMAP service. A rather simple exercise using hydra. So far I failed, since I've given hydra the actual website instead of the mail ...
1
vote
1answer
180 views

Hydra not matching password provided in file

I was pen-testing my TP-Link router yesterday and tried performing a Hydra attack on it. I wrote the following line on the terminal: hydra -l admin -p passwords.txt 192.168.0.1 http The username and ...
1
vote
1answer
3k views

What is EAPOL payload in WPA2 Cracking?

I am currently working on a python script to crack WPA2. From this SO question: How exactly does 4-way handshake cracking work? I've all of the necessary fields as described, i.e. Addresses, NONCES,...
0
votes
1answer
80 views

Crack Hashed Byte Array? [closed]

I know it would take forever to crack a simple hashed byte array, though for learning sake I was wondering whether it is possible to crack a hashed byte array? And if so, any suggestions how to do ...
4
votes
1answer
153 views

Customized approach to protect plaintext passwords/usernames in database table?

I'm in the process of building an app to let users sign up, connect their many email accounts (like Gmail) to the site, and allow email-related activities... like sending an email (please don't ask or ...